2 files changed, 35 insertions, 3 deletions
diff --git a/src/theming/lua-lib/expect.lua b/src/theming/lua-lib/expect.lua
index f4cade7..9afbb49 100644
--- a/src/theming/lua-lib/expect.lua
+++ b/src/theming/lua-lib/expect.lua
@@ -94,7 +94,7 @@ end
 -- @throws If the field is not one of the allowed types.
 local function field(tbl, index, ...)
     expect(1, tbl, "table")
-    expect(2, index, "string")
+    expect(2, index, "string", "number")
 
     local value = tbl[index]
     local t = native_type(value)
diff --git a/src/theming/lua-lib/html.lua b/src/theming/lua-lib/html.lua
index de65d6a..386618b 100644
--- a/src/theming/lua-lib/html.lua
+++ b/src/theming/lua-lib/html.lua
@@ -1,12 +1,44 @@
 -- SPDX-License-Identifier: AGPL-3.0-only
 
+local function html_escape(s)
+  expect(1, s, "string")
+
+  s = string.gsub(s, "&", "&amp;")
+  s = string.gsub(s, "<", "&lt;")
+  s = string.gsub(s, ">", "&gt;")
+  s = string.gsub(s, "'", "&#39;")
+  s = string.gsub(s, "\"", "&quot;")
+
+  return s
+end
+
 local function html(el, tbl)
   expect(1, el, "string")
-  expect(2, el, "table")
+  expect(2, tbl, "table")
+
+  innerHtml = ""
+  attributes = ""
 
   for k, v in pairs(tbl) do
     if type(k) == "string" then
-      expect.field(tbl, k, "string", "table")
+      expect.field(tbl, k, "string")
+      attributes = attributes .. " " .. k .. "='" .. html_escape(v) .. "'"
     end
   end
+  for k, v in ipairs(tbl) do
+    expect.field(tbl, k, "string", "table")
+    if type(v) == "table" then v = html_escape(v[1]) end
+    innerHtml = innerHtml .. v
+  end
+
+  return string.format("<%s%s>%s</%s>", el, attributes, innerHtml, el)
 end
+
+local function root(tbl)
+  return "<!DOCTYPE html>\n" .. html("html", tbl)
+end
+
+return setmetatable(
+  { root    = root },
+  { __call  = html,
+    __index = function (idx) return function(tbl) html(idx, tbl) end end })